PHP Allow Url Fopen

Allow URL Fopen is enabled

PHP includes a setting, allow_url_fopen, that allows PHP’s file functions such as file_get_contents(), include, require statements and others to retrieve data, in real time, from remote locations, such as FTP servers and web sites. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering. allow_url_fopen is on by default in PHP.

This vulnerability means that allow_url_fopen is still set to On. We highly recommend you set this to off.

Next Steps

Step 1: Log into the AED GUI, click on Configuration and select the AED configuration menu option. This will open the AED configuration screen.

Step 2: Scroll down to PHP_CHECKS and make sure this is set to “yes”. By default AED will only warn about PHP vulnerabilities. If you set this to yes, it will also fix these vulnerabilities. If this is set to “no” the next step will not work, so set this to “yes”.

Step 3: Scroll down to PHP_URL_FOPEN and set this to “no”.

Step 4: Click the “update” button.

This will resolve the vulnerability.